{"id":"ASB-A-365975561","details":"In saveGlobalProxyLocked of DevicePolicyManagerService.java, there is a possible way to desync from persistence due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-365975561","CVE-2025-48552"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/d5fee58e64ae237d4720b67de152c72cad432eae"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"line_hashes":["201633379875360665646869455272688402449","288601726329186386117510990504054772970","196997335450530709465077362757979950488","273751660295431841883684583117337769054","329191942919032605567954151777017913869","59960503925704668785743406738583040666","75851719969231313971657831443700341877"],"threshold":0.9},"id":"ASB-A-365975561-b9010149","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2ea32931ef9a06a762b8cf21584f156140672472","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false},{"digest":{"length":802,"function_hash":"43049679245358985349852202327242378119"},"id":"ASB-A-365975561-c97cd23e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2ea32931ef9a06a762b8cf21584f156140672472","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java","function":"saveGlobalProxyLocked"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2ea32931ef9a06a762b8cf21584f156140672472"],"severity":"High","spl":"2025-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-365975561.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bdd8fbba5bfa3f0c6ea838e1882ad394100a8109"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"length":835,"function_hash":"49639378997988961016167459904804225271"},"id":"ASB-A-365975561-240a793d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bdd8fbba5bfa3f0c6ea838e1882ad394100a8109","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java","function":"saveGlobalProxyLocked"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bdd8fbba5bfa3f0c6ea838e1882ad394100a8109","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["260532600982899483790208317464426921261","235764991148192914396330519255368466877","179295908367442358274145847198729870664","176689909264972438874061989468456471732","330404221401735496573702290612688553395","281434450182866316697680142586399258748","75851719969231313971657831443700341877"]},"id":"ASB-A-365975561-94af1e50","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-365975561.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java","function":"saveGlobalProxyLocked"},"deprecated":false,"digest":{"function_hash":"43049679245358985349852202327242378119","length":802},"id":"ASB-A-365975561-aecf4c19","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2658e2f12b660e81f8baccd98bcf41a693145ed6"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2658e2f12b660e81f8baccd98bcf41a693145ed6","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"line_hashes":["201633379875360665646869455272688402449","288601726329186386117510990504054772970","196997335450530709465077362757979950488","273751660295431841883684583117337769054","329191942919032605567954151777017913869","59960503925704668785743406738583040666","75851719969231313971657831443700341877"],"threshold":0.9},"id":"ASB-A-365975561-aeedccdb","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2658e2f12b660e81f8baccd98bcf41a693145ed6"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-365975561.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"target":{"function":"saveGlobalProxyLocked","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"function_hash":"49639378997988961016167459904804225271","length":835},"id":"ASB-A-365975561-c65c7f7d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"line_hashes":["260532600982899483790208317464426921261","235764991148192914396330519255368466877","179295908367442358274145847198729870664","176689909264972438874061989468456471732","330404221401735496573702290612688553395","281434450182866316697680142586399258748","75851719969231313971657831443700341877"],"threshold":0.9},"id":"ASB-A-365975561-de0cc158","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-365975561.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["260532600982899483790208317464426921261","235764991148192914396330519255368466877","179295908367442358274145847198729870664","176689909264972438874061989468456471732","330404221401735496573702290612688553395","281434450182866316697680142586399258748","75851719969231313971657831443700341877"]},"id":"ASB-A-365975561-096ea95c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false},{"target":{"function":"saveGlobalProxyLocked","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"function_hash":"49639378997988961016167459904804225271","length":835},"id":"ASB-A-365975561-e0c98f4f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c"],"severity":"High","spl":"2025-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-365975561.json"}}],"schema_version":"1.9.0"}